Security
Each school's data is its own.
Every row belongs to one school
Every table carries the school's id and Postgres row-level security enforces it on every query, for every role. A test suite generated from the database catalogue proves a member of one school sees zero rows of another.
Staff access is a logged session, not a key
Together's support staff cannot see a school's data by default. They open a session for a stated reason, it expires within an hour, and the school sees every session ever opened on it in its own settings.
Children's data stays inside the school
Rosters, pickup arrangements, attendance and medical notes are visible only to the roles the school grants, and the school can change what each role sees from a permissions console. We never sell data or use it for advertising.
Money goes to the school's own account
Dues, store sales and donations settle into the school's own Stripe account. Together is not the merchant of record for your bake sale.
Messages come from the school
Email sends as the school with replies to the school. A text STOP on a school's own number silences that school and no other.
Webhooks fail closed, secrets stay in a vault
Every inbound webhook is signature-verified and refuses to run without its secret. Provider credentials live in Supabase Vault and are never readable by the app's public roles.
You can leave, and take everything
An owner can close the school from Settings. The public site stops at once; after fourteen days every row and file is removed.
Privacy & security FAQ
The questions schools ask before they sign up
Answered as what the product does today. Where we do not hold a certification, we say so.
Where the data lives
- Where is our data stored?
- In a Postgres database and file storage run by Supabase in the United States (Northern Virginia), with the application itself served by Vercel, also in the United States. Data is encrypted in transit and at rest, and Supabase takes daily backups.
- Who else handles it?
- Six providers, each for one job: Supabase (database, sign-in, file storage and the secrets vault), Vercel (hosting), Stripe (payments and subscriptions), Resend (email delivery), Twilio (text messages and WhatsApp), and Anthropic (AI writing help, only when a school switches it on, and only with the text it submits). If a school turns on Google or Microsoft sign-in, those companies see the sign-in itself and nothing else. Nobody else receives any of it. We do not sell personal information or use it for advertising.
- Who owns the data?
- The school. Everything a school and its members put in belongs to the school, which decides who sees it and can take all of it out or delete it. For that data we are the school's processor and act only on its instructions. The one thing we control ourselves is the account and billing details of the people who run a school.
Who can see what
- Can Together's staff see our school's data?
- Not by default. A staff member has to open a support session on your school, for a stated reason, and it ends by itself after sixty minutes. Every session ever opened on your school is listed under Settings → Data, with who opened it, why and when.
- Can another school on Together see ours?
- No. Every row in the database carries the school it belongs to, and Postgres row-level security applies that on every query for every role, including ours. An isolation test suite runs against the database and fails the build if a member of one school can read a row of another.
- What can other parents see about my family?
- Nothing, until a member chooses to be listed in the directory. Listing is off by default; once on, separate switches control whether the email address (on), phone number (off) and children with their class (on) appear. Children are otherwise visible only to their own guardians, the teachers and coaches responsible for them, and the school's administrators.
- Who can read a child's medical notes?
- Only the roles the school has granted “See medical notes” in its permissions console, and the school's administrators. That grant is enforced in the database, not just in the page: a role without it cannot fetch the notes at all.
- Who decides what teachers, coaches and room parents see?
- The school, from a permissions console that lists every capability and every role. Changes take effect in the database as well as in the sidebar, so revoking something removes access rather than hiding a menu item.
Children and AI
- Do children have accounts?
- No. Accounts are for adults. The school enters its roster and parents claim and keep their own children's details current. We never collect information from a child, and our terms do not allow anyone under thirteen to register.
- Is our data used to train AI?
- No. AI features are off until a school switches them on. When they are on, the model receives only the text the school submits for help, such as a draft newsletter, and, for the in-app assistant, the member's question with their first name and role. Rosters, children's records, messages and contact details are never sent to it, and nothing sent is used to train models.
- Are you COPPA or FERPA compliant? SOC 2?
- A SOC 2 assessment is under way, Type 1 first and Type 2 after it, and we will publish the report when it is issued; until then we do not claim it. We have not been assessed against COPPA or FERPA. What is true today: parents and the school supply children's information, the school controls it, we process it only on the school's instructions, and a school subject to FERPA or COPPA keeps responsibility for the consents those require. We provide a privacy policy and terms the school can adopt for its own members, and we will answer a school's security questionnaire honestly.
Messages and consent
- How do text messages and consent work?
- Every member chooses their own channels, email, push and text, under Notifications. Texts come from the school, and a reply of STOP, UNSUBSCRIBE, CANCEL, END or QUIT silences that school's number at once and is recorded. The text-messaging programme disclosure is published on every school's site.
- How long are notifications and reports kept?
- In-app notifications are deleted thirty days after they are read, or after a hundred and eighty days if never read. Attendance reports from parents keep an append-only change history, so an edit never overwrites what was first said. Everything else lives as long as the school does.
Money
- Do you see card numbers?
- No. Card details are entered on Stripe's hosted pages and never pass through Together. For a school's subscription we see the last four digits and the billing history. Dues, store sales and donations from families settle into the school's own Stripe account; we take only the platform fee stated for the school's plan.
Leaving, and when something goes wrong
- Can we get everything out?
- Yes. Settings → Data builds a full export of the school on request, every table and every file in one archive, with a download link that stays good for 7 days. Members, families, the directory, sign-ups, surveys and polls also export to a spreadsheet from their own pages. Nothing is held back and nothing is charged for it.
- What happens when we close the school?
- The owner closes it from Settings. The public site stops answering at once; fourteen days later every record and file is deleted, and backups age out within thirty days after that. Within the fourteen days the owner can change their mind.
- What if there is a security incident?
- We tell the affected school's owner what happened, what data was involved and what we did about it within 72 hours of confirming it, and sooner where we can, and we help the school tell its members. Every inbound webhook is signature-checked, provider secrets live in a vault the application's public roles cannot read, and staff access is logged, so the record of what was touched exists before anyone has to ask for it.
- Do you support two-factor sign-in?
- Yes. Any member can turn on an authenticator app under Profile, and from then on every sign-in asks for a six-digit code as well as the password, or as well as a Google or Microsoft sign-in. It is the person's choice rather than the school's requirement today.
The full terms are in the Platform Privacy Policy and Platform Terms.